Common Vulnerabilities and Exposures assigned an identifier CVE-2011-0720 to the following vulnerability:

Name: CVE-2011-0720 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0720 Assigned: 20110131 Reference: http://plone.org/products/plone/security/advisories/cve-2011-0720 Reference: http://www.securityfocus.com/bid/46102 Reference: http://secunia.com/advisories/43146 Reference: http://xforce.iss.net/xforce/xfdb/65099

Unspecified vulnerability in Plone 2.5 through 4.0 allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.

The hotfix for this issue is available here: http://plone.org/products/plone-hotfix/releases/CVE-2011-0720/

Some Plone components are included in conga, so this flaw may have some impact there.

A security flaw was found in the way Luci administration application processed ticket cookies. A remote attacker, with certain knowledge of running Luci instance environment details could use this flaw to bypass standard Luci authentication mechanism (access resources which should be otherwise protected by authentication).